Dual Pfsense Firewalls With LACP bonded ports
-
HI, Im currently re-designing my office network.
For security reasons my organisation has purchased 2 pfsense SG-4860 appliances. Now i want to setup and edge firewall and and internal firewall for added security.
example
Internet 2 –--
\ LACP BOND LACP BOND
Internet 1----- PfsenseEdge ====== PfsenseINT ====== switch ===== LANSo far i have tried lagging up both pfsense firewalls together only to realise that they are both talking LACP and trying to offer each other LACP packets to setup the link, can i force one pfsense to listen like a switch and the other to offer LACP packets is this possible ? e.g. would I need to configure this from the root console not the GUI ?
The reason i would like to use this setup is i would like to run 2 IDS on both boxes.
Any help or information would be appreciated
kind regards
k
-
pfSense is not a switch. Use a switch.
-
yes i know pfsense is not a switch.
I'm asking if two pfsense boxes can be bonded together, i already have my pfsenseINT configured as a lagg to my lan switches.
Why is this feature not available, one would assume that having a bonded lagg between two pieces of networking equipment would be possible, i would like to double throughput between the devices?
-
yes i know pfsense is not a switch.
Does not seem so, considering the topic of the thread. Stick an LACP-capable switch between the boxes.
-
" i would like to double throughput between the devices?"
And would the boxes use both of those for "extra" bandwidth. You might want to do a bit more research on how lagg works.. Why would 2 macs take different paths over the lagg? etherchannel, lagg, port channel, etc.. whatever you want to call it is not 1+1=2, its 1 and 1.. No single session would use both links, mac to same mac is always going to use the same path in the lagg, etc.
If you have lots of devices talking then sure you can spread the load across the 2 links. But no single device is going to see more bandwidth then the 1 path.. So how does this get more bandwidth between your pfsense boxes??
"i would like to run 2 IDS on both boxes. "
What does that have to do with more bandwidth? You mean you would run 1 ids on box 1, and another ids on box 2 - not 2 ids on each box??
So do you think the pfsense boxes can do frame by frame load balancing across your lagg? Something like a brocade VSC fabric? There seems to be a real lack of understanding when it comes to laggs in general.
So in your drawing does internet 1 and 2 exceed gig?
-
Layer4 LACP allows to load balance by protocol and port. but I'm not sure if ever device needs to support it.
-
Ok so I eneded up putting a switch between the two,
I know that LACP provides fault tolerance and load balancing but it will not increase my bandwidth, each link will be treated separately, if I wanted to increase bandwidth I would use a round robin scheduler on both ends.
The reason I have lacp between both pfsense boxes is to provide another link to load balance tcp connections as well as vpn traffic through.
The main reason I posted my question was to find out whether pfsense could be set to setup a LACP link between two pfsense boxes without additional hardware. I soon found out that this was not possible.
And yes a seperate IDS on each box. After adding the switch to my network design this has opened up a third location to stick an IDS
Kind Regards.
This issue can be closed
